Medical Identity Theft Recovery: Fixing Sanford or Avera Health Records in South Dakota

Discovering a $14,000 emergency room bill from Sioux Falls or Rapid City for a hospital visit you never made is alarming enough, but the hidden danger of medical identity theft in South Dakota is clinical, not just financial. Because regional healthcare networks like Sanford Health and Avera Health link hospitals, rural clinics, and pharmacies across the state through unified Electronic Health Records (EHRs) and the South Dakota Health Link exchange, an imposter who uses your insurance card or Social Security number merges their blood type, drug allergies, psychiatric history, and surgical notes directly into your permanent medical chart.

If you are later admitted to an emergency department in Aberdeen, Brookings, or Yankton, a physician relying on that corrupted chart could administer a fatal blood transfusion or withhold pain medication because an impersonator was flagged as an opioid seeker under your name. Untangling a compromised medical file requires invoking specific federal HIPAA privacy rules, state pharmacy monitoring laws, and Fair Credit Reporting Act (15 U.S.C. § 1681) protections in the right sequence.

How Medical Identity Theft Corrupts Sanford and Avera Health Charts

South Dakota law treats medical records as highly protected, confidential communications under S.D. Codified Laws § 19-19-503 and S.D. Codified Laws § 36-2-16.2. In Wipf v. Altstiel, 888 N.W.2d 790 (SD Supreme Court 2016) and Ferguson v. Thaemert, 952 N.W.2d 277 (SD Supreme Court 2020), the South Dakota Supreme Court emphasized that patient medical charts enjoy strict legal safeguards against unauthorized disclosure or tampering. Ironically, those same privacy rules often make hospital billing and Health Information Management (HIM) staff hesitant to show a victim the full billing and clinical trail created by an imposter-claiming that releasing the fraudulent encounter notes might violate the imposter's HIPAA privacy rights.

To break through this bureaucratic stalemate with Sanford Health or Avera Health, you must exercise your statutory rights as the named individual on the record under the federal HIPAA Privacy Rule, 45 C.F.R. § 164.524 (right of access), 45 C.F.R. § 164.526 (right to amend), and 45 C.F.R. § 164.528 (right to an accounting of disclosures).

Resolving Specific Medical Identity Theft Scenarios in South Dakota

Demanding a HIPAA Accounting of Disclosures and Chart Amendment

Before you can clean your Sanford MyChart or AveraChart profile, you must identify every clinic, imaging center, lab, and insurer that received the corrupted data. Under 45 C.F.R. § 164.528, you have the legal right to demand a written Accounting of Disclosures covering the prior six years, and the health system must provide it within 60 days (with the first accounting in any 12-month period completely free). Simultaneously, under S.D. Codified Laws § 36-2-16.2 and 45 C.F.R. § 164.524, demand copies of all intake registration forms, driver's license scans, and electronic signature pads from the disputed dates of service.

Once you identify the imposter's encounters, submit a formal written request to amend your Designated Record Set under 45 C.F.R. § 164.526 to the hospital's Privacy Officer and HIM Chart Correction Unit. Under 45 C.F.R. § 164.526(b)(2), Sanford or Avera must act on your amendment request within 60 days (with at most one 30-day written extension). If the hospital refuses to purge or segregate the imposter's clinical data, 45 C.F.R. § 164.526(c) gives you the right to file a formal Statement of Disagreement that must be permanently appended to and transmitted with every future disclosure of your chart.

Correcting Prescription Drug Histories and Opioid Misattributions

One of the most common motives for medical identity theft in South Dakota is obtaining Schedule II, III, or IV controlled substances-such as oxycodone, hydrocodone, or amphetamines-under another patient's identity. Every controlled substance dispensed in the state is logged within 24 hours into the South Dakota Prescription Drug Monitoring Program (SD PDMP), established under S.D. Codified Laws § 34-20E-2 and S.D. Admin. R. § 20:51:32:01 and administered by the South Dakota Board of Pharmacy, Sioux Falls at 4001 W. Valhalla Blvd., Suite 102, Sioux Falls, SD 57106 (phone: 605-362-2737).

If a thief fills opioid prescriptions using your name and date of birth, every South Dakota physician and pharmacist who checks the SD PDMP will see a multi-prescriber alert flagging you for doctor shopping or substance abuse. Under S.D. Codified Laws § 34-20E-5 and S.D. Codified Laws § 34-20E-7, a patient may request their own central repository prescription history from the South Dakota Board of Pharmacy, Sioux Falls by submitting a notarized patient request form and government ID, and can then supply a police report for S.D. Codified Laws § 22-40-8 identity theft and S.D. Codified Laws § 22-42-8 (obtaining a controlled substance by fraud or forgery) so the Board and dispensing pharmacy can flag and correct the fraudulent entries.

Disputing Fraudulent Medicare and South Dakota Medicaid Claims

When scammers steal a senior's Medicare Beneficiary Identifier (MBI) or a family's South Dakota Medicaid number to bill for phantom durable medical equipment, genetic testing swabs, or inpatient hospital stays, your lifetime benefit caps and pre-authorization eligibility can be exhausted. If your Explanation of Benefits (EOB) or Medicare Summary Notice shows fraudulent charges, report them immediately:

• South Dakota Medicaid Fraud: Under S.D. Codified Laws § 22-45-2, submitting false or fraudulent Medicaid claims is a felony. Victims should file a report with the South Dakota Department of Social Services, Office of Program Integrity, Pierre at 700 Governors Drive, Pierre, SD 57501 (phone: 605-773-3165) and the Office of the South Dakota Attorney General, Medicaid Fraud Control Unit, Pierre at 1302 E. Highway 14, Suite 1, Pierre, SD 57501 (phone: 605-773-3215) to decouple the fraudulent claims from your recipient profile.
• Medicare Fraud: Call 1-800-MEDICARE and contact the South Dakota Senior Medicare Patrol (SMP) at 1-800-822-8804 to request a compromised number replacement and submit Form CMS-10106, FED, Centers for Medicare & Medicaid Services, Medicare Authorization to Disclose Personal Health Information if a family member or attorney is handling the dispute.

Invoking FCRA Rights to Clear Medical Debts Without Debt Harassment

Unpaid hospital bills in South Dakota are rapidly assigned to regional third-party medical debt collectors that aggressively file civil lawsuits in Magistrate or Circuit Court. If you call a collector and casually offer a partial settlement or ask for a payment plan just to make them go away, you risk unintentionally acknowledging the debt or resetting the 6-year contract statute of limitations under S.D. Codified Laws § 15-2-13.

Instead, invoke two strict federal statutes in writing. First, within 30 days of a collector's initial notice, send a written dispute and debt validation demand under the Fair Debt Collection Practices Act (FDCPA), 15 U.S.C. § 1692g(b), stating unequivocally that the account is the result of criminal identity theft under S.D. Codified Laws § 22-40-8-which legally forces the collector to cease all collection activity until they obtain verification from the hospital. Second, send your police report and Form FTC-IDTR, FED, Federal Trade Commission, Identity Theft Report and Affidavit to Equifax, Experian, and TransUnion pursuant to 15 U.S.C. § 1681c-2. Under 15 U.S.C. § 1681c-2(a), the credit bureaus must block the reporting of any identity-theft-related medical tradeline within 4 business days and notify the medical debt furnisher, which is then barred from re-reporting or selling the debt under 15 U.S.C. § 1681s-2(a)(6).

Step-by-Step Process in South Dakota

Step 1: File a Police Report and FTC Identity Theft Report

Report the medical impersonation to your local police department in Sioux Falls, Rapid City, Aberdeen, or your county sheriff under S.D. Codified Laws § 22-40-8 and complete Form FTC-IDTR, FED, Federal Trade Commission, Identity Theft Report and Affidavit. Hospital fraud departments and credit bureaus will not unmerge electronic health charts or block collection accounts without an official law enforcement report number.

Step 2: Serve a HIPAA Amendment and Accounting Demand on the Health System

Send a certified letter to the Privacy Officer at Sanford Health (Sioux Falls) or Avera Health (Sioux Falls) demanding an Accounting of Disclosures under 45 C.F.R. § 164.528 and a formal chart amendment under 45 C.F.R. § 164.526. Explicitly instruct their Health Information Management (HIM) team to unmerge the imposter's encounters from your Master Patient Index (MPI) and push a corrected update to the South Dakota Health Link health information exchange.

Step 3: Audit Your SD PDMP Controlled Substance Profile

Submit a notarized patient record request to the South Dakota Board of Pharmacy, Sioux Falls under S.D. Codified Laws § 34-20E-7 to verify that no fraudulent opioid or stimulant prescriptions were filled in your name at retail pharmacies.

Step 4: Trigger the 4-Day FCRA Credit Block and FDCPA Cease-Collection Notice

Mail your police report, FTC Identity Theft Report, government ID, and a letter identifying the fraudulent medical accounts to all three credit bureaus under 15 U.S.C. § 1681c-2, and send copies to the hospital's patient financial services department and any third-party collection agency under 15 U.S.C. § 1681s-2(a)(6)(B) and 15 U.S.C. § 1692g.

Step 5: File Federal OCR Complaints or Retain a Consumer Litigation Attorney

If a health provider refuses to respond to your amendment request within 60 days, file Form HHS-700, FED, U.S. Department of Health and Human Services, Health Information Privacy Complaint Form within 180 days, and file Form Consumer Complaint, South Dakota, Office of the Attorney General, Consumer Protection Division, Consumer Complaint with the Office of the South Dakota Attorney General, Consumer Protection Division, Pierre. If a medical debt collector sues you in the Second Judicial Circuit Court, Minnehaha County, Sioux Falls or the Seventh Judicial Circuit Court, Pennington County, Rapid City, or refuses to remove credit reporting after an FCRA dispute under 15 U.S.C. § 1681s-2(b), hire a South Dakota consumer rights lawyer from our directory to counterclaim for statutory damages and attorney fees.

How Much Does it Cost in South Dakota?

• HIPAA Accounting of Disclosures & Chart Amendment: Under 45 C.F.R. § 164.526 and 45 C.F.R. § 164.528, submitting a chart amendment request and requesting your first Accounting of Disclosures in a 12-month period costs $0 (free by federal law).
• Medical Record Copy Fees: Under 45 C.F.R. § 164.524(c)(4), when a patient requests electronic copies of their own EHR records, hospitals can only charge a reasonable, cost-based fee (typically a flat fee of $6.50 or less for electronic delivery, whereas state statutory rates under S.D. Codified Laws § 36-2-16.4 apply only to third-party paper requests).
• FCRA 4-Business-Day Identity Theft Block & Credit Freeze: Placing a credit block under 15 U.S.C. § 1681c-2 and a South Dakota security freeze under S.D. Codified Laws § 54-15-17 costs $0.
• Consumer Protection & Healthcare Privacy Attorney Fees: For FCRA (15 U.S.C. § 1681n) and FDCPA (15 U.S.C. § 1692k) violations by medical debt collectors and credit bureaus, most South Dakota consumer attorneys work on a contingency or fee-shifting basis ($0 upfront) because federal law forces the violating collector or bureau to pay your attorney fees. For complex HIPAA clinical chart unmerging, hourly attorney consultations range from $250 to $400 per hour.

How Long Does the Process Take?

Frequently Asked Questions (FAQ)